Tag Info

New answers tagged

1

HTTP headers are like any other user data, and should be sanitized by webapplications. You might be able to use it to XSS yourself when you go to a "whats my ip" kind of website that displays this kind of information, if it's been built by developers who assumed HTTP headers are OK to send back to the user. I've seen happen in a webapplication to view logs ...


1

The ExternalInferface.call() is designed for invoking javascript, so this function as written effectively gives you the opportunity to invoke arbitrary javascript in the execution context of the website, which is already a serious security hole. http://help.adobe.com/en_US/AS2LCR/Flash_10.0/help.html?content=00001039.html How specifically to exploit it? ...


3

No, not at all. What you did, is just a simple XSS test on your own browser. No other user can be affected by the XSS you coded to run on your own computer. You can deploy the same vulnerability on your own hosted website: that way, your website will be either XSS vulnerable. In which case, it can either be used against your own website by hackers wanting ...


3

No, loading an HTML file from your computer is never an XSS vulnerability. You can run whatever code you want locally, but that doesn't affect the website. Cross-site scripting is about getting your code executed on other user's browsers so you can interact with their session for that site. Whether that is stealing a session cookie, performing actions, or ...


0

Is your application returning HTML when you GET /cart ? If it is then you could try using the ZAP persistent XSS scanner - that should inject XSS attacks via the POST and then check all of the URLs where the payload is displayed. If the GET doesnt return html then it all depends how that data gets used. FYI we have a ZAP Users group which is probably more ...


1

Usually, demonstrating an attack under a single browser is sufficient for a penetration testing engagement, unless it's an environment where only Chrome is being used or similar. That being said, I'm guessing this is a reflected XSS, so it's probably being caught by Chrome's XSS auditor: ...


2

An attacker can try to phish me with a malicious url, steal my cookies or my history etc... but does he also need my intervention or a human interaction for his attack? The source could be anywhere there is a link for you to follow: an email, a forum, a Facebook post, Twitter, or it could be that you are already browsing an evil or compromised website. ...


0

The purpose of XSS is to encourage a user to believe that the content they are viewing is hosted by a legitimate provider, which would lead to them taking some action that would cause them to be compromised more. There are innumerable attacks that can be performed against you if you click on a link that directs you to a malicious website. The success of the ...


0

Yes, non persistent does require human interaction, but it can affect more than just you and your employees. It can affect everyone using your website.


3

No it is not safe. You are correct that the JSONP service could deliver arbitrary JavaScript, which is then executed as part of your site. Because JSONP is essentially a hack to get around the same origin policy, it is not possible for a JavaScript framework to perform sanitisation. These days, CORS is the preferred way to call external sites. An ...


0

You need to move away from Windows if you really want to learn anything about "hacking". Yes, you can do some stuff with Cain and Abel and some GUI tools, but that isn't the right way to learn about computer security. This is where I started. First, become familiar with a beginner Linux distribution, the command line, and how it differs from Windows. There ...


1

There are no specific tool to hack. If you want to "hack" on the web , you will generally use technology that are available on the web; example Javascript. First, I would start by learning how things work in general on a website and then you will see some possible vulnerability and understand why we do certain things to block them. Owasp is a very good site ...


1

First - Nessus checks for vulnerabilities. There's a massive array of places to get educated. If you're wanting to learn for illegal activities, you're on your own. If it's for ethical hacking aka penetration testing then check these out: The Basics of Hacking and Penetration Testing, Second Edition [Book] Sans.org [Classes, free white papers] OWASP [A-Z ...


6

In short, you don't need SOFTWARE, you need KNOWLEDGE. Seek that first, then the tools can help.


1

Probably want to use a hidden input form field for storing user input instead of putting it inline. You can sanitize it before storing it but in this example its sanitized on demand. The actual sanitizing of the user input can be done at different times in different languages, so is just abstracted with jazzhands. <script> var myNamespace = {}; ...


5

It's very possible: texttexttext=function(){};alert(document.cookie); Would give you execution of your code, regardless of what the string literal is. You just make it into a unused function - and you execute everything after that. Edit: plus - you can often use single quotes as a substitute for double quotes.


2

Some browsers like Chrome have anti-XSS features which block obvious attacks. If you open the JavaScript console of your browser, you should see the warnings. Either turn off the protection temporarily or use a different browser.


0

Whenever I need to test a particular website to check for xss vulnerabilities, I use this Firefox plugin: https://addons.mozilla.org/nl/firefox/addon/xss-me/ It gives you a nice first impression of possible vulnerabilities that exist. It is recommended to study up on JS and XSS in particular. Do not go for a scriptkiddie approach :)


0

Doing this $("#img").attr('src',imgPath); is very bad. You allow an attacker to execute arbitrary javascript with your user's credentials. But even if you block javascript and allow only url's the attacker can craft links which will allow him to execute a get request on any arbitrary url on behalf of your users. When the browser renders an node it gets the ...


1

XSS isn't just about making alert boxes appear and redirecting to other pages, there are other things it can do. ;) What are you doing with the input that the user specifies? Does this get stored in a database, or is it used to retrieve images? The input that you are taking in, does it get redisplayed anywhere on your site? If so there could be a ...


0

If you use $("#img").attr('src', imgPath); i believe http://example.com/?image=javascript:alert("Hi"); would work. However, as you said, the prepended /Images/ should at least kill all Javascript. Still, it is possible to display any image accessible through your websever (and by that meaning any php-scripts etc) as $("#img"), e.g.: ...


2

Michal Zalewski aka lcamtuf made some interesting posts recently and showed some pocs and explanation on how to do it with modern browsers: read first: post @ bugtraq History theft with CSS Boolean algebra Defend Your Spaceship! very impressive research imho


0

Solutions for Google XSS Chanllenge 2 : - http://www.securitytube.net/video/10388


1

The semicolon is an old, mostly-obsolete value for the CGI record separator, but it's still recognized by many CGI scripts. Most likely what's happening is that your /url?cookie1=first_value;another_cookie=another_value&cookie2=second_value is being interpreted as cookie1=first_value another_cookie=another_value cookie2=second_value and since the ...



Top 50 recent answers are included